Switch 2: Fuses: Difference between revisions

From Nintendo Switch Brew
Jump to navigation Jump to search
← Older edit
No edit summary
No edit summary
 
(5 intermediate revisions by the same user not shown)
Line 3: Line 3:
The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.
The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.


== Physical Layout ==
= Physical Layout =
 
== Fuse words ==
Fuses are laid out in 32-bit words.
 
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Fuse Word || Bits || Value
! Fuse Word || Bits || Value
|-
|-
| 0 || 5..8 || OdmLock
| style="background: yellow" |
|-
| style="background: yellow" |
| 0 || 9 || Fa
| style="background: yellow" | [[#Shadowed Fuses]] Begin
|-
|-
| 0 || 10 || SecurityMode
| 0 || 5..8 || [[#OdmLock]]
|-
|-
| 0 || 11 || ArmJtagDisable
| 0 || 9 || [[#Fa]]
|-
|-
| 0 || 16..20 || DebugAuthentication[0..4]
| 0 || 10 || [[#SecurityMode]]
|-
|-
| 1 || 5..8 || OdmLock (Shadow)
| 0 || 11 || [[#ArmJtagDisable]]
|-
|-
| 1 || 9 || Fa (Shadow)
| 0 || 12 || [[#NvJtagProtectionEnable]]
|-
|-
| 1 || 10 || SecurityMode (Shadow)
| 0 || 16..20 || [[#DebugAuthentication]]
|-
|-
| 1 || 11 || ArmJtagDisable (Shadow)
| 0 || 28 || ZeroizeDis
|-
| 1 || 16..20 || DebugAuthentication[0..4]
|-
|-
| 2 || 2..31 || ReservedOdm0[0..29]
| 2 || 2..31 || ReservedOdm0[0..29]
|-
| 3 || 2..31 || ReservedOdm0[0..29]
|-
|-
| 4 || 0..1 || ReservedOdm0[30..31]
| 4 || 0..1 || ReservedOdm0[30..31]
|-
|-
| 4 || 2..31 || ReservedOdm1[0..29]
| 4 || 2..31 || ReservedOdm1[0..29]
|-
| 5 || 0..1 || ReservedOdm0[30..31] (Shadow)
|-
| 5 || 2..31 || ReservedOdm1[0..29] (Shadow)
|-
|-
| 6 || 0..1 || ReservedOdm1[30..31]
| 6 || 0..1 || ReservedOdm1[30..31]
|-
|-
| 6 || 2..31 || ReservedOdm2[0..29]
| 6 || 2..31 || ReservedOdm2[0..29]
|-
| 7 || 0..1 || ReservedOdm1[30..31] (Shadow)
|-
| 7 || 2..31 || ReservedOdm2[0..29] (Shadow)
|-
|-
| 8 || 0..1 || ReservedOdm2[30..31]
| 8 || 0..1 || ReservedOdm2[30..31]
|-
|-
| 8 || 2..31 || ReservedOdm3[0..29]
| 8 || 2..31 || ReservedOdm3[0..29]
|-
| 9 || 0..1 || ReservedOdm2[30..31] (Shadow)
|-
| 9 || 2..31 || ReservedOdm3[0..29] (Shadow)
|-
|-
| 10 || 0..1 || ReservedOdm3[30..31]
| 10 || 0..1 || ReservedOdm3[30..31]
|-
|-
| 10 || 2..31 || ReservedOdm4[0..29]
| 10 || 2..31 || ReservedOdm4[0..29]
|-
| 11 || 0..1 || ReservedOdm3[30..31] (Shadow)
|-
| 11 || 2..31 || ReservedOdm4[0..29] (Shadow)
|-
|-
| 12 || 0..1 || ReservedOdm4[30..31]
| 12 || 0..1 || ReservedOdm4[30..31]
|-
|-
| 12 || 2..31 || ReservedOdm5[0..29]
| 12 || 2..31 || ReservedOdm5[0..29]
|-
| 13 || 0..1 || ReservedOdm4[30..31] (Shadow)
|-
| 13 || 2..31 || ReservedOdm5[0..29] (Shadow)
|-
|-
| 14 || 0..1 || ReservedOdm5[30..31]
| 14 || 0..1 || ReservedOdm5[30..31]
|-
|-
| 14 || 2..31 || ReservedOdm6[0..29]
| 14 || 2..31 || ReservedOdm6[0..29]
|-
| 15 || 0..1 || ReservedOdm5[30..31] (Shadow)
|-
| 15 || 2..31 || ReservedOdm6[0..29]  (Shadow)
|-
|-
| 16 || 0..1 || ReservedOdm6[30..31]
| 16 || 0..1 || ReservedOdm6[30..31]
|-
|-
| 16 || 2..31 || ReservedOdm7[0..29]
| 16 || 2..31 || ReservedOdm7[0..29]
|-
| 17 || 0..1 || ReservedOdm6[30..31] (Shadow)
|-
| 17 || 2..31 || ReservedOdm7[0..29]  (Shadow)
|-
|-
| 18 || 0..1 || ReservedOdm7[30..31]
| 18 || 0..1 || ReservedOdm7[30..31]
Line 94: Line 66:
| 18 || 12..31 || HyperVoltaging[0..19]
| 18 || 12..31 || HyperVoltaging[0..19]
|-
|-
| 19 || 0..1 || ReservedOdm7[30..31] (Shadow)
| 18 || 2 || ObsDis
|-
| 19 || 5 || CcplexDfdAccessDisable[0]
|-
| 19 || 12..31 || HyperVoltaging[0..19] (Shadow)
|-
|-
| 20 || 0..11 || HyperVoltaging[20..31]
| 20 || 0..11 || HyperVoltaging[20..31]
|-
|-
| 21 || 0..11 || HyperVoltaging[20..31] (Shadow)
| 24 || 1  || ForceDbgWithTestKeys
|-
|-
| 24 || 2..31 || SysFwRatchet0[0..29]
| 24 || 2..31 || SysFwRatchet0[0..29]
|-
| 24 || 1  || ForceDbgWithTestKeys
|-
| 25 || 1  || ForceDbgWithTestKeys
|-
| 25 || 2..31 || SysFwRatchet0[0..29] (Shadow)
|-
|-
| 26 || 0..1  || SysFwRatchet0[30..31]
| 26 || 0..1  || SysFwRatchet0[30..31]
|-
|-
| 26 || 2..31 || SysFwRatchet1[0..29]
| 26 || 2..31 || SysFwRatchet1[0..29]
|-
| 27 || 0..1  || SysFwRatchet0[30..31] (Shadow)
|-
| 27 || 2..31 || SysFwRatchet1[0..29] (Shadow)
|-
|-
| 28 || 0..1  || SysFwRatchet1[30..31]
| 28 || 0..1  || SysFwRatchet1[30..31]
|-
|-
| 28 || 2..31 || SysFwRatchet2[0..29]
| 28 || 2..31 || SysFwRatchet2[0..29]
|-
| 29 || 0..1  || SysFwRatchet1[30..31] (Shadow)
|-
| 29 || 2..31 || SysFwRatchet2[0..29]  (Shadow)
|-
|-
| 30 || 0..1  || SysFwRatchet2[30..31]
| 30 || 0..1  || SysFwRatchet2[30..31]
|-
|-
| 30 || 2..31 || SysFwRatchet3[0..29] (Shadow)
| 30 || 2..31 || SysFwRatchet3[0..29] (Shadow)
|-
| 31 || 0..1  || SysFwRatchet2[30..31]
|-
| 31 || 2..31 || SysFwRatchet3[0..29] (Shadow)
|-
|-
| 32 || 0..1  || SysFwRatchet3[30..31]
| 32 || 0..1  || SysFwRatchet3[30..31]
|-
|-
| 32 || 2..31 || CcplexUcodeFieldRatchet[0..29]
| 32 || 2..31 || CcplexUcodeFieldRatchet[0..29]
|-
| 33 || 2..31 || CcplexUcodeFieldRatchet[0..29]
|-
|-
| 34 || 0..1 || CcplexUcodeFieldRatchet[30..31]
| 34 || 0..1 || CcplexUcodeFieldRatchet[30..31]
|-
|-
| 34 || 2..31 || Mb1FieldRatchet[0..29]
| 34 || 2..31 || Mb1FieldRatchet[0..29]
|-
| 35 || 0..1 || CcplexUcodeFieldRatchet[30..31]
|-
| 35 || 2..31 || Mb1FieldRatchet[0..29]
|-
|-
| 36 || 0..1 || Mb1FieldRatchet[30..31]
| 36 || 0..1 || Mb1FieldRatchet[30..31]
|-
|-
| 36 || 22..23 || DebugAuthentication[5..6]
| 36 || 4 || IntegrityCheckEnable
|-
| 36 || 28 || CcplexDfdAccessDisable
|-
|-
| 37 || 0..1 || Mb1FieldRatchet[30..31]
| 36 || 5 || Usb2NvJtagDisable
|-
|-
| 37 || 22..23 || DebugAuthentication[5..6] (Shadow)
| 36 || 6 || OptIstDisableDebug
|-
| 37 || 28 || CcplexDfdAccessDisable (Shadow)
|-
| 33 || 0..1  || SysFwRatchet3[30..31] (Shadow)
|-
|-
| 36 || 21 || SecurityModeReduntant
| 36 || 21 || SecurityModeReduntant
|-
|-
| 37 || 21 || SecurityModeReduntant (Shadow)
| 36 || 22..23 || DebugAuthentication[5..6]
|-
|-
| 36 || 5 || Usb2NvJtagDisable
| 36 || 24 || ForceDbgWithTestKeys
|-
|-
| 36 || 24 || ForceDbgWithTestKeys
| 36 || 25 || FaRedundant
|-
|-
| 36 || 25 || FaRedundant
| 36 || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 36 || 26 || ForceDbgWithTestKeysDuringPscDbg
| 36 || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 36 || 27 || ForceDbgWithTestKeysDuringPscDbg
| 36 || 28 || CcplexDfdAccessDisable
|-
| 37  || 5  || Usb2NvJtagDisable
|-
| 37  || 24 || ForceDbgWithTestKeys
|-
| 37  || 25 || FaRedundant (Shadow)
|-
| 37  || 26 || ForceDbgWithTestKeysDuringPscDbg
|-
| 37  || 27 || ForceDbgWithTestKeysDuringPscDbg
|-
|-
| 46 || 1 || EnableCrJtagSecurity
| 46 || 1 || EnableCrJtagSecurity
Line 194: Line 122:
| 46 || 7..22 || BctFieldRatchet[0..15]
| 46 || 7..22 || BctFieldRatchet[0..15]
|-
|-
| 47 || 1 || EnableCrJtagSecurity
| 46 || 23 || RevokePkH0
|-
|-
| 47 || 6 || ArmJtagDisableRedundant (Shadow)
| 46 || 24 || RevokePkH1
|-
| 47 || 7..22 || BctFieldRatchet[0..15] (Shadow)
|-
|-
| 72 || 14..31 || PscBlFieldRatchet[0..17]
| 72 || 14..31 || PscBlFieldRatchet[0..17]
|-
| 73 || 14..31 || PscBlFieldRatchet[0..17]
|-
|-
| 74 || 0..13 || PscBlFieldRatchet[18..31]
| 74 || 0..13 || PscBlFieldRatchet[18..31]
|-
| 75 || 0..13 || PscBlFieldRatchet[18..31]
|-
|-
| 74 || 30..31 || RomFeatureDisable[0..1]
| 74 || 30..31 || RomFeatureDisable[0..1]
|-
| 75 || 30..31 || RomFeatureDisable[0..1] (Shadow)
|-
|-
| 76 || 0..13 || RomFeatureDisable[18..31]
| 76 || 0..13 || RomFeatureDisable[18..31]
Line 218: Line 138:
| 76 || 20..25 || FsiDebugAuthentication[0..5]
| 76 || 20..25 || FsiDebugAuthentication[0..5]
|-
|-
| 77 || 0..13 || RomFeatureDisable[18..31] (Shadow)
| style="background: yellow" |
|-
| style="background: yellow" |
| 77 || 14..19 || FsiDebugAuthentication[0..5] (Shadow)
| style="background: yellow" | [[#Shadowed Fuses]] End
|-
| 77 || 20..25 || FsiDebugAuthentication[0..5] (Shadow)
|-
|-
| 84 || 32 || Sku
| 84 || 32 || Sku
Line 249: Line 167:
|-
|-
| 170 || 14..20 || PscBlNvRevision[0..6] |
| 170 || 14..20 || PscBlNvRevision[0..6] |
|-
| style="background: yellow" |
| style="background: yellow" |
| style="background: yellow" | [[#H2]] CRC32 Begin
|-
|-
| 188 || 21..31 || PublicKeyHash[0][0..10]
| 188 || 21..31 || PublicKeyHash[0][0..10]
Line 307: Line 229:
|-
|-
| 202 || 0..1 || OdmId[1][30..31]
| 202 || 0..1 || OdmId[1][30..31]
|-
| 202 || 7 || OptInEnable
|-
|-
| 202 || 8..31 || PublicKeyHash[8][0..23]
| 202 || 8..31 || PublicKeyHash[8][0..23]
Line 403: Line 327:
|-
|-
| 226 || 0..7  || EvitaCsk[224..255]
| 226 || 0..7  || EvitaCsk[224..255]
|-
| 226 || 8..23 || SecuritySwOdm[0..15]
|-
|-
| 226 || 24 || OemFuseEncShadow
| 226 || 24 || OemFuseEncShadow
|-
| 242 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 242 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 243 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 243 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 244 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 244 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 245 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 245 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 246 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 246 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 247 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 247 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 248 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 248 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 249 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 249 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 250 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 250 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 251 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 251 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 252 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 252 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 253 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 253 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 254 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 254 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 255 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 255 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 256 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 256 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 257 || 25..31 || PkcPubkeyHash1[0..6]
|-
| 257 || 0..24  || PkcPubkeyHash1[7..31]
|-
| 258 || 0..24  || PkcPubkeyHash1[7..31]
|-
|-
| 258 || 25..31 || [[#H2]][0..6]
| 258 || 25..31 || [[#H2]][0..6]
|-
|-
| 259 || 0..24 || [[#H2]][7..31]
| 259 || 0..24 || [[#H2]][7..31]
|-
| style="background: yellow" |
| style="background: yellow" |
| style="background: yellow" | [[#H2]] CRC32 End
|-
|-
| 727 || 0..31 || PscOdmStatic[0..31]
|-
| 728 || 0..31 || PscOdmStatic[0..31]
|-
| 729 || 0..31 || EndorseKey[0..31]
|-
| 730 || 0..31 || EndorseKey[32..63]
|-
| 731 || 0..31 || EndorseKey[64..95]
|-
| 732 || 0..31 || EndorseKey[96..127]
|-
| 733 || 0..31 || EndorseKey[128..159]
|-
| 734 || 0..31 || EndorseKey[160..191]
|-
| 735 || 0..31 || EndorseKey[192..223]
|-
| 736 || 0..31 || EndorseKey[224..255]
|-
| 737 || 0..31 || EndorseKey[256..287]
|-
| 738 || 0..31 || EndorseKey[288..319]
|-
| 739 || 0..31 || EndorseKey[320..351]
|-
| 740 || 0..31 || EndorseKey[352..383]
|-
| 741 || 0..31 || EndorseKey[384..415]
|-
| 742 || 0..31 || EndorseKey[416..447]
|-
| 743 || 0..31 || EndorseKey[448..479]
|-
| 744 || 0..31 || EndorseKey[480..511]
|-
| 745 || 0..8  || EndorseKey[512..520]
|-
| 746 || 0..31 || EndorseKeyTag[0..31]
|-
| 747 || 0..31 || EndorseKeyTag[32..63]
|-
| 748 || 0..31 || EndorseKeyTag[64..95]
|-
| 749 || 0..31 || EndorseKeyTag[96..127]
|-
| 750 || 0..31 || EvitaIdk[0..31]
|-
| 751 || 0..31 || EvitaIdk[32..63]
|-
| 752 || 0..31 || EvitaIdk[64..95]
|-
| 753 || 0..31 || EvitaIdk[96..127]
|-
| 754 || 0..31 || EvitaIdk[128..159]
|-
| 755 || 0..31 || EvitaIdk[160..191]
|-
| 756 || 0..31 || EvitaIdk[192..223]
|-
| 757 || 0..31 || EvitaIdk[224..255]
|-
| 758 || 0..31 || EvitaIdkTag[0..31]
|-
| 759 || 0..31 || EvitaIdkTag[32..63]
|-
| 760 || 0..31 || EvitaIdkTag[64..95]
|-
| 761 || 0..31 || EvitaIdkTag[96..127]
|-
| 762 || 0..31 || OemFuseIv[0..31]
|-
| 763 || 0..31 || OemFuseIv[32..63]
|-
| 764 || 0..31 || OemFuseIv[64..95]
|-
| 765 || 0..31 || OemFuseIvTag[0..31]
|-
| 766 || 0..31 || SecureBootKey[0..31]
|-
| 767 || 0..31 || SecureBootKey[32..63]
|-
| 768 || 0..31 || SecureBootKey[64..95]
|-
| 769 || 0..31 || SecureBootKey[96..127]
|-
| 770 || 0..31 || SecureBootKey[128..159]
|-
| 771 || 0..31 || SecureBootKey[160..191]
|-
| 772 || 0..31 || SecureBootKey[192..223]
|-
| 773 || 0..31 || SecureBootKey[224..255]
|-
| 774 || 0..31 || SecureBootKeyTag[0..31]
|-
| 775 || 0..31 || SecureBootKeyTag[32..63]
|-
| 776 || 0..31 || SecureBootKeyTag[64..95]
|-
| 777 || 0..31 || SecureBootKeyTag[96..127]
|-
| 778 || 0..31 || Kdk0[0..31]
|-
| 779 || 0..31 || Kdk0[32..63]
|-
| 780 || 0..31 || Kdk0[64..95]
|-
| 781 || 0..31 || Kdk0[96..127]
|-
| 782 || 0..31 || Kdk0[128..159]
|-
| 783 || 0..31 || Kdk0[160..191]
|-
| 784 || 0..31 || Kdk0[192..223]
|-
| 785 || 0..31 || Kdk0[224..255]
|-
| 786 || 0..31 || Kdk0Tag[0..31]
|-
| 787 || 0..31 || Kdk0Tag[32..63]
|-
| 788 || 0..31 || Kdk0Tag[64..95]
|-
| 789 || 0..31 || Kdk0Tag[96..127]
|-
| 790 || 0..31 || OemK1[0..31]
|-
| 791 || 0..31 || OemK1[32..63]
|-
| 792 || 0..31 || OemK1[64..95]
|-
| 793 || 0..31 || OemK1[96..127]
|-
| 794 || 0..31 || OemK1[128..159]
|-
| 795 || 0..31 || OemK1[160..191]
|-
| 796 || 0..31 || OemK1[192..223]
|-
| 797 || 0..31 || OemK1[224..255]
|-
| 798 || 0..31 || OemK1Tag[0..31]
|-
| 799 || 0..31 || OemK1Tag[32..63]
|-
| 800 || 0..31 || OemK1Tag[64..95]
|-
| 801 || 0..31 || OemK1Tag[96..127]
|-
| 802 || 0..31 || OemK2[0..31]
|-
| 803 || 0..31 || OemK2[32..63]
|-
| 804 || 0..31 || OemK2[64..95]
|-
| 805 || 0..31 || OemK2[96..127]
|-
| 806 || 0..31 || OemK2[128..159]
|-
| 807 || 0..31 || OemK2[160..191]
|-
| 808 || 0..31 || OemK2[192..223]
|-
| 809 || 0..31 || OemK2[224..255]
|-
| 810 || 0..31 || OemK2Tag[0..31]
|-
| 811 || 0..31 || OemK2Tag[32..63]
|-
| 812 || 0..31 || OemK2Tag[64..95]
|-
| 813 || 0..31 || OemK2Tag[96..127]
|-
| 814 || 0..31 || FkddSk[0..31]
|-
| 815 || 0..31 || FkddSk[32..63]
|-
| 816 || 0..31 || FkddSk[64..95]
|-
| 817 || 0..31 || FkddSk[96..127]
|-
| 818 || 0..31 || FkddSk[128..159]
|-
| 819 || 0..31 || FkddSk[160..191]
|-
| 820 || 0..31 || FkddSk[192..223]
|-
| 821 || 0..31 || FkddSk[224..255]
|-
| 822 || 0..31 || FkddSkTag[0..31]
|-
| 823 || 0..31 || FkddAk[0..31]
|-
| 824 || 0..31 || FkddAk[32..63]
|-
| 825 || 0..31 || FkddAk[64..95]
|-
| 826 || 0..31 || FkddAk[96..127]
|-
| 827 || 0..31 || FkddAk[128..159]
|-
| 828 || 0..31 || FkddAk[160..191]
|-
| 829 || 0..31 || FkddAk[192..223]
|-
| 830 || 0..31 || FkddAk[224..255]
|-
| 831 || 0..31 || FkddAkTag[0..31]
|}
|}


=== Shadowed Fuses ===
The first 80 fuse words are 40 pairs redundantly stored next to each other. These fuses are field-updatable. One bit inside a word can be programmed at a time.


== Fuses ==
Many security sensitive fuses are in this region.
 
Both shadowed values should always agree with each other, and they should be programmed together without a reset in-between.
 
The two redundant bits are OR'd together which protects 1 from becoming a 0.
 
=== H2 Fuses ===
These fuses are protected by the H2 CRC32. Once programmed, they cannot be updatable arbitrarily.
 
= Fuses =
Some fuses are mirrored in MMIO registers.
Some fuses are mirrored in MMIO registers.


Line 665: Line 883:
| 127 || ||  
| 127 || ||  
|}
|}
== OdmLock ==
OdmLock is a 4-bit wide field that allows locking 32-bit fields of: ReservedOdm0, ReservedOdm1, ReservedOdm2, ReservedOdm3.
ReservedOdm Banks 4-7 do not have this lock feature.
ReservedOdm Banks 4-7 are ratchet fuses (used for anti-downgrade).
== Fa ==
Failure analysis mode.
== NvJtagProtectionEnable ==
If set, [[#Fa]] cannot be used.
== SecurityMode ==
According to documentation, this acts as a lock for "all manufacturing fuses", and prevents them from being read or modified.
Also known as the "ODM production mode" fuse.
== ArmJtagDisable ==
External debug paths disable for both Arm JTAG and USB SWD.
== DebugAuthentication ==
Fine-grained disables on debug signals.
bit0: Forces dbgen to 0
bit1: Forces niden to 0
bit2: Forces spiden to 0
bit3: Forces spniden to 0
bit4: Forces deviceen to 0


== SecBootDeviceSelect ==
== SecBootDeviceSelect ==
Line 671: Line 923:
== H2 ==
== H2 ==
CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.
CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.
Valid if SecurityMode == 1.

Latest revision as of 20:55, 6 February 2026

T23x has a 0x1000-byte (16384 bit) fuse block.

The fuse layout can be found by reverse engineering fskp_t234.bin from the Linux4Tegra package.

Physical Layout

Fuse words

Fuses are laid out in 32-bit words.

Fuse Word Bits Value
#Shadowed Fuses Begin
0 5..8 #OdmLock
0 9 #Fa
0 10 #SecurityMode
0 11 #ArmJtagDisable
0 12 #NvJtagProtectionEnable
0 16..20 #DebugAuthentication
0 28 ZeroizeDis
2 2..31 ReservedOdm0[0..29]
4 0..1 ReservedOdm0[30..31]
4 2..31 ReservedOdm1[0..29]
6 0..1 ReservedOdm1[30..31]
6 2..31 ReservedOdm2[0..29]
8 0..1 ReservedOdm2[30..31]
8 2..31 ReservedOdm3[0..29]
10 0..1 ReservedOdm3[30..31]
10 2..31 ReservedOdm4[0..29]
12 0..1 ReservedOdm4[30..31]
12 2..31 ReservedOdm5[0..29]
14 0..1 ReservedOdm5[30..31]
14 2..31 ReservedOdm6[0..29]
16 0..1 ReservedOdm6[30..31]
16 2..31 ReservedOdm7[0..29]
18 0..1 ReservedOdm7[30..31]
18 5 CcplexDfdAccessDisable[0]
18 12..31 HyperVoltaging[0..19]
18 2 ObsDis
20 0..11 HyperVoltaging[20..31]
24 1 ForceDbgWithTestKeys
24 2..31 SysFwRatchet0[0..29]
26 0..1 SysFwRatchet0[30..31]
26 2..31 SysFwRatchet1[0..29]
28 0..1 SysFwRatchet1[30..31]
28 2..31 SysFwRatchet2[0..29]
30 0..1 SysFwRatchet2[30..31]
30 2..31 SysFwRatchet3[0..29] (Shadow)
32 0..1 SysFwRatchet3[30..31]
32 2..31 CcplexUcodeFieldRatchet[0..29]
34 0..1 CcplexUcodeFieldRatchet[30..31]
34 2..31 Mb1FieldRatchet[0..29]
36 0..1 Mb1FieldRatchet[30..31]
36 4 IntegrityCheckEnable
36 5 Usb2NvJtagDisable
36 6 OptIstDisableDebug
36 21 SecurityModeReduntant
36 22..23 DebugAuthentication[5..6]
36 24 ForceDbgWithTestKeys
36 25 FaRedundant
36 26 ForceDbgWithTestKeysDuringPscDbg
36 27 ForceDbgWithTestKeysDuringPscDbg
36 28 CcplexDfdAccessDisable
46 1 EnableCrJtagSecurity
46 6 ArmJtagDisableRedundant
46 7..22 BctFieldRatchet[0..15]
46 23 RevokePkH0
46 24 RevokePkH1
72 14..31 PscBlFieldRatchet[0..17]
74 0..13 PscBlFieldRatchet[18..31]
74 30..31 RomFeatureDisable[0..1]
76 0..13 RomFeatureDisable[18..31]
76 14..19 FsiDebugAuthentication[0..5]
76 20..25 FsiDebugAuthentication[0..5]
#Shadowed Fuses End
84 32 Sku
87 14..27 ReservedProduction
97 22..28 CcplexUcodeNvRevision[0..6]
105 18..23 MphyNvCalib[0..5]
105 24..30
106 12..31 BootNvInfo[0..19]
107 0..11 BootNvInfo[20..31]
108 13 AsyncL1aRstEnable
108 14 AsyncL0RstEnable
107 0..11 BootNvInfo[20..31]
119 14..15 BootRo
127 7 BootRomSelect
170 14..20
#H2 CRC32 Begin
188 21..31 PublicKeyHash[0][0..10]
189 0..20 PublicKeyHash[0][11..31]
189 21..31 PublicKeyHash[1][0..10]
190 0..20 PublicKeyHash[1][11..31]
190 21..31 PublicKeyHash[2][0..10]
191 0..20 PublicKeyHash[2][11..31]
191 21..31 PublicKeyHash[3][0..10]
192 0..20 PublicKeyHash[3][11..31]
192 21..31 PublicKeyHash[4][0..10]
193 0..20 PublicKeyHash[4][11..31]
193 21..31 PublicKeyHash[5][0..10]
194 0..20 PublicKeyHash[5][11..31]
194 21..31 PublicKeyHash[6][0..10]
195 0..20 PublicKeyHash[6][11..31]
195 21..31 PublicKeyHash[7][0..10]
196 0..20 PublicKeyHash[7][11..31]
196 21..31 BootDevInfo[0..10]
197 0..12 BootDevInfo[19..31]
198 5..8 MphyOdmCalib[0..3]
198 9..22 BootSecurityInfo[0..14]
200 0..1 SecureProvisionInfo[0..1]
202 2..5 SecureInSysBistCtrl[0..3]
202 6..6 Flw2[0..0]
199 0..8 BootSecurityInfo[15..31]
199 9..24 OdmInfo[0..15]
200 2..31 OdmId[0][0..29]
201 0..1 OdmId[0][30..31]
201 2..31 OdmId[1][0..29]
202 0..1 OdmId[1][30..31]
202 7 OptInEnable
202 8..31 PublicKeyHash[8][0..23]
203 0..7 PublicKeyHash[8][24..31]
203 8..31 PublicKeyHash[9][0..23]
204 0..7 PublicKeyHash[9][24..31]
204 8..31 PublicKeyHash[10][0..23]
205 0..7 PublicKeyHash[10][24..31]
205 8..31 PublicKeyHash[11][0..23]
206 0..7 PublicKeyHash[11][24..31]
206 8..31 PublicKeyHash[12][0..23]
207 0..7 PublicKeyHash[12][24..31]
207 8..31 PublicKeyHash[13][0..23]
208 0..7 PublicKeyHash[13][24..31]
208 8..31 PublicKeyHash[14][0..23]
209 0..7 PublicKeyHash[14][24..31]
209 8..31 PublicKeyHash[15][0..23]
210 0..7 PublicKeyHash[15][24..31]
210 8..31 EvitaMvk[0..31]
211 0..7 EvitaMvk[0..31]
211 8..31 EvitaMvk[32..63]
212 0..7 EvitaMvk[32..63]
212 8..31 EvitaMvk[64..95]
213 0..7 EvitaMvk[64..95]
213 8..31 EvitaMvk[96..127]
214 0..7 EvitaMvk[96..127]
214 8..31 EvitaMvk[128..159]
215 0..7 EvitaMvk[128..159]
215 8..31 EvitaMvk[160..191]
216 0..7 EvitaMvk[160..191]
216 8..31 EvitaMvk[192..223]
217 0..7 EvitaMvk[192..223]
217 8..31 EvitaMvk[224..255]
218 0..7 EvitaMvk[224..255]
218 8..31 EvitaCsk[0..31]
219 0..7 EvitaCsk[0..31]
219 8..31 EvitaCsk[32..63]
220 0..7 EvitaCsk[32..63]
220 8..31 EvitaCsk[64..95]
221 0..7 EvitaCsk[64..95]
221 8..31 EvitaCsk[96..127]
222 0..7 EvitaCsk[96..127]
222 8..31 EvitaCsk[128..159]
223 0..7 EvitaCsk[128..159]
223 8..31 EvitaCsk[160..191]
224 0..7 EvitaCsk[160..191]
224 8..31 EvitaCsk[192..223]
225 0..7 EvitaCsk[192..223]
225 8..31 EvitaCsk[224..255]
226 0..7 EvitaCsk[224..255]
226 8..23 SecuritySwOdm[0..15]
226 24 OemFuseEncShadow
242 25..31 PkcPubkeyHash1[0..6]
242 0..24 PkcPubkeyHash1[7..31]
243 25..31 PkcPubkeyHash1[0..6]
243 0..24 PkcPubkeyHash1[7..31]
244 25..31 PkcPubkeyHash1[0..6]
244 0..24 PkcPubkeyHash1[7..31]
245 25..31 PkcPubkeyHash1[0..6]
245 0..24 PkcPubkeyHash1[7..31]
246 25..31 PkcPubkeyHash1[0..6]
246 0..24 PkcPubkeyHash1[7..31]
247 25..31 PkcPubkeyHash1[0..6]
247 0..24 PkcPubkeyHash1[7..31]
248 25..31 PkcPubkeyHash1[0..6]
248 0..24 PkcPubkeyHash1[7..31]
249 25..31 PkcPubkeyHash1[0..6]
249 0..24 PkcPubkeyHash1[7..31]
250 25..31 PkcPubkeyHash1[0..6]
250 0..24 PkcPubkeyHash1[7..31]
251 25..31 PkcPubkeyHash1[0..6]
251 0..24 PkcPubkeyHash1[7..31]
252 25..31 PkcPubkeyHash1[0..6]
252 0..24 PkcPubkeyHash1[7..31]
253 25..31 PkcPubkeyHash1[0..6]
253 0..24 PkcPubkeyHash1[7..31]
254 25..31 PkcPubkeyHash1[0..6]
254 0..24 PkcPubkeyHash1[7..31]
255 25..31 PkcPubkeyHash1[0..6]
255 0..24 PkcPubkeyHash1[7..31]
256 25..31 PkcPubkeyHash1[0..6]
256 0..24 PkcPubkeyHash1[7..31]
257 25..31 PkcPubkeyHash1[0..6]
257 0..24 PkcPubkeyHash1[7..31]
258 0..24 PkcPubkeyHash1[7..31]
258 25..31 #H2[0..6]
259 0..24 #H2[7..31]
#H2 CRC32 End
727 0..31 PscOdmStatic[0..31]
728 0..31 PscOdmStatic[0..31]
729 0..31 EndorseKey[0..31]
730 0..31 EndorseKey[32..63]
731 0..31 EndorseKey[64..95]
732 0..31 EndorseKey[96..127]
733 0..31 EndorseKey[128..159]
734 0..31 EndorseKey[160..191]
735 0..31 EndorseKey[192..223]
736 0..31 EndorseKey[224..255]
737 0..31 EndorseKey[256..287]
738 0..31 EndorseKey[288..319]
739 0..31 EndorseKey[320..351]
740 0..31 EndorseKey[352..383]
741 0..31 EndorseKey[384..415]
742 0..31 EndorseKey[416..447]
743 0..31 EndorseKey[448..479]
744 0..31 EndorseKey[480..511]
745 0..8 EndorseKey[512..520]
746 0..31 EndorseKeyTag[0..31]
747 0..31 EndorseKeyTag[32..63]
748 0..31 EndorseKeyTag[64..95]
749 0..31 EndorseKeyTag[96..127]
750 0..31 EvitaIdk[0..31]
751 0..31 EvitaIdk[32..63]
752 0..31 EvitaIdk[64..95]
753 0..31 EvitaIdk[96..127]
754 0..31 EvitaIdk[128..159]
755 0..31 EvitaIdk[160..191]
756 0..31 EvitaIdk[192..223]
757 0..31 EvitaIdk[224..255]
758 0..31 EvitaIdkTag[0..31]
759 0..31 EvitaIdkTag[32..63]
760 0..31 EvitaIdkTag[64..95]
761 0..31 EvitaIdkTag[96..127]
762 0..31 OemFuseIv[0..31]
763 0..31 OemFuseIv[32..63]
764 0..31 OemFuseIv[64..95]
765 0..31 OemFuseIvTag[0..31]
766 0..31 SecureBootKey[0..31]
767 0..31 SecureBootKey[32..63]
768 0..31 SecureBootKey[64..95]
769 0..31 SecureBootKey[96..127]
770 0..31 SecureBootKey[128..159]
771 0..31 SecureBootKey[160..191]
772 0..31 SecureBootKey[192..223]
773 0..31 SecureBootKey[224..255]
774 0..31 SecureBootKeyTag[0..31]
775 0..31 SecureBootKeyTag[32..63]
776 0..31 SecureBootKeyTag[64..95]
777 0..31 SecureBootKeyTag[96..127]
778 0..31 Kdk0[0..31]
779 0..31 Kdk0[32..63]
780 0..31 Kdk0[64..95]
781 0..31 Kdk0[96..127]
782 0..31 Kdk0[128..159]
783 0..31 Kdk0[160..191]
784 0..31 Kdk0[192..223]
785 0..31 Kdk0[224..255]
786 0..31 Kdk0Tag[0..31]
787 0..31 Kdk0Tag[32..63]
788 0..31 Kdk0Tag[64..95]
789 0..31 Kdk0Tag[96..127]
790 0..31 OemK1[0..31]
791 0..31 OemK1[32..63]
792 0..31 OemK1[64..95]
793 0..31 OemK1[96..127]
794 0..31 OemK1[128..159]
795 0..31 OemK1[160..191]
796 0..31 OemK1[192..223]
797 0..31 OemK1[224..255]
798 0..31 OemK1Tag[0..31]
799 0..31 OemK1Tag[32..63]
800 0..31 OemK1Tag[64..95]
801 0..31 OemK1Tag[96..127]
802 0..31 OemK2[0..31]
803 0..31 OemK2[32..63]
804 0..31 OemK2[64..95]
805 0..31 OemK2[96..127]
806 0..31 OemK2[128..159]
807 0..31 OemK2[160..191]
808 0..31 OemK2[192..223]
809 0..31 OemK2[224..255]
810 0..31 OemK2Tag[0..31]
811 0..31 OemK2Tag[32..63]
812 0..31 OemK2Tag[64..95]
813 0..31 OemK2Tag[96..127]
814 0..31 FkddSk[0..31]
815 0..31 FkddSk[32..63]
816 0..31 FkddSk[64..95]
817 0..31 FkddSk[96..127]
818 0..31 FkddSk[128..159]
819 0..31 FkddSk[160..191]
820 0..31 FkddSk[192..223]
821 0..31 FkddSk[224..255]
822 0..31 FkddSkTag[0..31]
823 0..31 FkddAk[0..31]
824 0..31 FkddAk[32..63]
825 0..31 FkddAk[64..95]
826 0..31 FkddAk[96..127]
827 0..31 FkddAk[128..159]
828 0..31 FkddAk[160..191]
829 0..31 FkddAk[192..223]
830 0..31 FkddAk[224..255]
831 0..31 FkddAkTag[0..31]

Shadowed Fuses

The first 80 fuse words are 40 pairs redundantly stored next to each other. These fuses are field-updatable. One bit inside a word can be programmed at a time.

Many security sensitive fuses are in this region.

Both shadowed values should always agree with each other, and they should be programmed together without a reset in-between.

The two redundant bits are OR'd together which protects 1 from becoming a 0.

H2 Fuses

These fuses are protected by the H2 CRC32. Once programmed, they cannot be updatable arbitrarily.

Fuses

Some fuses are mirrored in MMIO registers.

Some fuses are stored redundantly.

FuseId Name Length Mmio Notes
0 BootSecurityInfo 14 bits [0x3810268] & 0x3FFF
1 #SecBootDeviceSelect 3 bits [0x38101C0] & 7
2 Uid Complicated
3 Sku [0x3810110]
4 Tid [0x38101CC]
5 CpuSpeedo0 [0x3810114]
6 CpuSpeedo1
7 CpuSpeedo2
8 CpuIddq [0x3810478]
9 SocSpeedo0 [0x3810134]
10 SocSpeedo1
11 SocSpeedo2
12 Fa [0x38107BC]
13 Apb2JtagDisable [0x3810298]
14 TpcDisable [0x381030C]
15 Apb2JtagLock 1 bit ([0x38101F4] >> 3) & 1
16 SocIddq [0x3810140]
17 RomFeatureDisable [0x3810BF0]
18 BootNvInfo [0x3810578]
19 AsyncL1aRstEnable [0x38105B4]
20 AsyncL0RstEnable [0x38105B8]
21 OemFuseEncShadow [0x38108B8]
22 ReservedProduction [0x381014C]
23 HyperVoltaging [0x3810354]
24 MphyNvCalib [0x38104A0]
25 OptPrivSecEn [0x3810264]
26 UsbCalib [0x38101F0]
27 UsbCalibExt [0x3810350]
28 ProductionMode [0x3810100]
29 SecurityMode [0x38101A0]
30 OdmLock [0x3810108]
31 ArmJtagDisable [0x38101B8]
32 ReservedOdm0 [0x38101C8]
33 ReservedOdm1
34 ReservedOdm2 [0x38101D0]
35 ReservedOdm3 [0x38101D4]
36 ReservedOdm4 [0x38101D8]
37 ReservedOdm5 [0x38101DC]
38 ReservedOdm6 [0x38101E0]
39 ReservedOdm7 [0x38101E4]
40 BootRomSelect [0x3810868]
41 BootRo [0x381075C]
42 PublicKeyHash 512 bits [0x3810164]..[0x3810180] and [0x381065C]..[0x3810678] A SHA512 of the public key.
44 SwReserved 4 bits ([0x38101C0] >> 4) & 0xF
45 BootDevSelect 3 bits [0x38101C0] & 7
46 IgnoreBootDevStraps 1 bit ([0x38101C0] >> 3)
47 BootDevInfo [0x38101BC]
48 Mb1NvRevision [0x38104B8]
49 PscBlNvRevision [0x3810BD0]
50 SysFwRatchet0 [0x3810520]
51 SysFwRatchet1 [0x3810524]
52 SysFwRatchet2 [0x3810528]
53 SysFwRatchet3 [0x381052C]
54 Mb1FieldRatchet [0x3810534]
55 PscBlFieldRatchet [0x3810BD4]
56 CcplexUcodeFieldRatchet [0x3810530]
57 OdmId 64 bits [0x3810408]..[0x381040C]
58 #H2 [0x381043C]
59 OdmInfo [0x381029C]
60 DebugAuthentication [0x38102E4]
61 CcplexDfdAccessDisable [0x38102BC]
62 CvDisable [0x38104F8]
63 BctFieldRatchet [0x381091C]
64 CcplexUcodeNvRevision [0x3810364]
65 OptSampleType [0x3810244]
66 BootromPatchVersion [0x38104A8]
72 OptEmcDisable [0x38109C0]
73 SecureProvisionIndex [0x38102E8]
74 OptCcplexClusterDisable [0x3810314]
75 OptGpcDisable [0x3810288]
76 OptDlaDisable [0x38104F0]
77 FsiDebugAuthentication [0x3810C48]
78 EvitaMvk 256 bits [0x38107CC]..[0x38107E8]
79 EvitaCsk 256 bits [0x38107EC]..[0x3810808]
80 SecureProvisionInfo [0x38102EC]
81 MphyOdmCalib [0x3810224]
82 ForceDbgWithTestKeys [0x38104C8]
83 ForceDbgWithTestKeysDuringPscDbg [0x38107C0]
84 SecureInSysBistCtrl [0x38104CC]
85 Flw2 [0x3810568]
86 Usb2NvJtagDisable [0x3810590]
87 EnableCrJtagSecurity [0x3810884]
88 OptInEnable [0x38105A8]
89 SecuritySwOdm [0x3810840]
90 ZeroizeDis [0x38109A8]
91 IntegrityCheckEnable [0x3810540]
92 NvJtagProtectionEnable [0x38101EC]
93 PkcPubkeyHash1 512 bits [0x3810920]..[0x381095C]
94 PkcPubkeyHash2 512 bits [0x3810960]..[0x38109BC]
95 PscOdmStatic
96 EndorseKey
97 EndorseKeyTag
98 EvitaIdk
99 EvitaIdkTag
100 OemFuseIv
101 OemFuseIvTag
102 SecureBootKey
103 SecureBootKeyTag
104 Kdk0
105 Kdk0Tag
106 OemK1
107 OemK1Tag
108 OemK2
109 OemK2Tag
110 FkddSk
111 FkddSkTag
112 FkddAk
113 FkddAkTag
114 RevokePkH0 [0x38109A0]
115 RevokePkH1 [0x38109A4]
116 ObsDis [0x38101E8]
117 OptIstDisableDebug [0x38105C4]
118 [0x3810BD8]
119 [0x3810CC8]
120 [0x3810830]
121 [0x3810834]
122 [0x3810A24]
123 [0x3810A28]
124 [0x3810A2C]
125 [0x3810A30]
126 [0x3810A14]
127

OdmLock

OdmLock is a 4-bit wide field that allows locking 32-bit fields of: ReservedOdm0, ReservedOdm1, ReservedOdm2, ReservedOdm3.

ReservedOdm Banks 4-7 do not have this lock feature.

ReservedOdm Banks 4-7 are ratchet fuses (used for anti-downgrade).

Fa

Failure analysis mode.

NvJtagProtectionEnable

If set, #Fa cannot be used.

SecurityMode

According to documentation, this acts as a lock for "all manufacturing fuses", and prevents them from being read or modified.

Also known as the "ODM production mode" fuse.

ArmJtagDisable

External debug paths disable for both Arm JTAG and USB SWD.

DebugAuthentication

Fine-grained disables on debug signals.

bit0: Forces dbgen to 0

bit1: Forces niden to 0

bit2: Forces spiden to 0

bit3: Forces spniden to 0

bit4: Forces deviceen to 0

SecBootDeviceSelect

Only valid if IgnoreBootDevStraps == 1.

H2

CRC32 of physical fuse words #188 bit20 and above, up to word #259 bit24. Uses polynomial 0x1EDC6F41.

Retrieved from "https://switchbrew.org/w/index.php?title=Switch_2:_Fuses&oldid=14282"